{"id":"bdf5dd02-2442-4b03-9556-37ce83b3ed35","arxiv_id":"2501.03800","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Adapting CLIP with LoRA and a classification head detects face morphing attacks at levels competitive with specialized MAD systems.","lead":"This paper adapts the CLIP foundation model to detect face morphing attacks by fine-tuning LoRA adapters and adding a classification layer. It reports competitive cross-dataset results, positioning foundation-model adaptation as a viable route for morphing attack detection.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The FM pre-training attribution rests on a from-scratch ViT trained for only 40 epochs; if undertrained, the 16.93 pp gap is not evidence for FM knowledge.","rationale":"The paper's novelty is the adaptation of foundation models to MAD, and the only experiment explicitly designed to isolate the contribution of pre-trained weights is the ViT-FS comparison. The FE comparison shows that LoRA-based adaptation helps, but it does not by itself show that the benefit originates from CLIP's pre-training. Since the abstract and conclusion attribute the improvement to the FM's built-in knowledge, the fairness and convergence of ViT-FS is load-bearing. The concern is not that ViT-FS is outside current consensus; it is that no evidence is provided that 40 epochs is enough for a from-scratch ViT-L on a small synthetic dataset. The Table 2 ViT-L row shift is an additional, independently verifiable correctness risk in the literature-competitiveness claim; it is a factual error that can be fixed, so it supports a conditional verdict rather than rejection. The paper also has genuine strengths: the code is released, Table 1 is internally consistent, and the FE-versus-MADation comparison is a fair test of adaptation. If the authors retrain ViT-FS to convergence and correct Table 2, the central claims can be reassessed on much firmer evidence.","tokens_in":19130,"tokens_out":9205,"duration_ms":79720,"concrete_test":"Retrain ViT-FS ViT-L from scratch on SMDD with identical data augmentation but a longer budget (e.g., 200 epochs with cosine decay, or until validation EER plateaus) and report the average EER over at least three seeds. If the average EER stays near the reported 28.87%, the pre-training attribution is supported; if it drops substantially toward MADation's 11.94%, the headline gap is an artifact of an undertrained baseline. Independently, reconstruct Table 2's ViT-L block from Table 1 by dataset label and recompute the best/second-best counts and the WebMorph superiority claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that MADation benefits from CLIP's pre-trained knowledge is established by comparing against ViT-FS, a randomly initialized ViT-B/ViT-L trained from scratch on SMDD for only 40 epochs (Section 3.3 and Implementation Details, Section 4). With ViT-L's ~300M parameters and a 40k-image training set at batch size 256, 40 epochs is roughly 6,300 steps, and no learning-rate schedule or convergence criterion is reported. It is therefore plausible that ViT-FS is undertrained, in which case the reported 16.93 pp average EER advantage (Table 1) conflates the value of CLIP's pre-training with a larger effective optimization budget available to MADation. A separate, concrete inconsistency reinforces the need for caution: in Table 2, the ViT-L MADation rows after MIPGAN II are shifted relative to Table 1; the row labeled OpenCV contains Table 1's MorDIFF scores, WebMorph contains Table 1's OpenCV scores, and MorDIFF contains Table 1's WebMorph scores. The text's claim that ViT-L consistently outperforms prior work on WebMorph rests on this mislabeled row. Neither issue necessarily breaks the approach, but both must be resolved before the stated claims are taken as established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MADation, a face morphing attack detection (MAD) framework obtained by adapting CLIP vision encoders with rank-stabilized LoRA (rsLoRA) and a trainable binary classification header. The models are trained on the synthetic SMDD dataset and evaluated on MAD22, MorDIFF, and FRLL-Morphs. The central empirical claim is that LoRA-adapted CLIP (ViT-B and ViT-L) outperforms the paper's own transformer/FM baselines (zero-shot text-image, frozen feature extractor, and from-scratch ViT) and is competitive with or better than recent MAD methods, with reported average EER reductions of 16.93 pp over ViT-FS and 8.10 pp over FE for ViT-L. The implementation is publicly released.","tokens_in":19404,"tokens_out":5102,"duration_ms":46922,"significance":"If the central claims hold, the paper would be a useful demonstration that foundation-model representations can be adapted to the domain-specific MAD task with parameter-efficient fine-tuning, and it would be among the first works to apply FM adaptation to face morphing detection. The paper has several strengths: it provides public code, trains on a separate synthetic dataset rather than tuning on the test benchmarks, evaluates across three common MAD benchmarks, and includes ablations that separate the contributions of frozen features and LoRA adaptation. However, the strength of the headline claims is weakened by a concrete inconsistency in Table 2 and by a from-scratch ViT baseline that appears undertrained; these issues need to be resolved before the reported advantages can be taken as established.","major_comments":[{"comment":"In Table 2, the ViT-L MADation rows after MIPGAN II are shifted relative to Table 1. Specifically, the row labeled OpenCV in Table 2 contains the values that Table 1 reports for MorDIFF (EER 19.26), the row labeled WebMorph contains Table 1's OpenCV values (EER 2.23), and the row labeled MorDIFF contains Table 1's WebMorph values (EER 20.40). The text in Section 5 states that \"ViT-L consistently outperforms the remaining techniques in FaceMorph, MIPGAN II and WebMorph,\" but that WebMorph claim rests on the mislabeled row; Table 1 gives WebMorph EER 20.40 for ViT-L MADation, not 2.23. This shift also affects the reported counts of best/second-best results. The table and the associated comparative claims must be corrected.","section":"§5, Table 2"},{"comment":"The claim that FM pre-training is the source of MADation's advantage over ViT-FS is not well supported because the ViT-FS baseline is trained from scratch for only 40 epochs with no reported learning-rate schedule or convergence criterion. For ViT-L with roughly 300 million parameters, a batch size of 256, and about 40k SMDD training images, 40 epochs is only about 6,300 optimization steps, which is very likely insufficient to train a ViT of this size from random initialization. The reported 16.93 pp average EER gap over ViT-FS may therefore reflect an difference in effective optimization budget rather than the value of CLIP's pre-trained knowledge. The authors should either train ViT-FS to convergence with a comparable budget and schedule, or substantially temper the attribution claim.","section":"§3.3 and §4 (Implementation Details)"},{"comment":"All results are reported as single point estimates with no error bars, multiple seeds, or statistical significance tests. Given that some comparisons are close (e.g., ViT-B FE average EER 21.45 vs. ViT-FS 22.13, and several per-dataset differences of 1-2 pp), the claims that MADation \"surpasses\" baselines and is \"competitive\" with prior work would be more convincing with variance estimates or a reproducibility study over at least a few seeds.","section":"§5, Table 1"}],"minor_comments":[{"comment":"The text refers to \"Alexey et al. [2]\" for the tokenization/preprocessing of ViT; the reference is to Dosovitskiy et al., which should be cited correctly, and the misspelling \"non-overleaping\" should be corrected to \"non-overlapping.\"","section":"§4 (Image Pre-Processing)"},{"comment":"The notation \"ViT-B and ViT-L\" is clear, but the model sizes (86M and 0.3 billion parameters) are given in inconsistent units; the paper should state both values in a uniform way.","section":"§4 (Model Architecture)"},{"comment":"Table 3 has formatting issues that affect readability: values are concatenated with dataset names (e.g., \"FRLL-Style-GAN216.64\" and \"FRLL-Style-GAN211.37\"), and the column header \"EER (%)BPCER (%) @ APCER (%)\" is missing a separator. These should be cleaned up in the final version.","section":"Table 3"},{"comment":"The D-FW-CDCN row in Table 2 appears malformed, with the FaceMorph entry reading \"FaceMorph0.00 44.10MIPGANI\" and subsequent values running together; this makes the row difficult to interpret and should be fixed.","section":"Table 2"},{"comment":"The paper alternates between \"adaption\" and \"adaptation\"; the authors should choose one spelling and apply it consistently.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The Table 2 row shift is the most concrete issue and directly affects the comparative claims; it is likely a copy-paste error but must be fixed and the surrounding text re-examined. The ViT-FS baseline concern is also serious because it challenges the attribution of the gains to foundation-model knowledge, though it is addressable by additional experiments or a more careful wording. The paper fits the scope of the journal and the public-code release is a plus. No concerns about novelty disclosure beyond the standard practice of citing the authors' own benchmark papers."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper to know about: MADation applies the familiar CLIP-plus-LoRA recipe to face morphing attack detection, and it works. The paper is the first to do this for MAD, releases code, and reports a systematic ablation (zero-shot text-image, frozen feature extractor, from-scratch ViT, and LoRA-adapted CLIP) across MAD22, MorDIFF, and FRLL-Morphs. The core result, that LoRA adaptation beats a frozen CLIP header by about 8-10 pp average EER, is plausible and supported by the numbers. That part of the method is solid.\n\nThe soft spots are two. First, Table 2 has a concrete row misalignment for ViT-L MADation: OpenCV, WebMorph, and MorDIFF rows contain each other's values from Table 1. The text's claim that ViT-L 'consistently outperforms' prior work on WebMorph rests on that mislabeled row; the correct WebMorph EER is 20.40%, which is not superior to several published baselines. The error is easy to fix but needs to be corrected before the comparison claims stand. Second, the attribution of the gain to foundation-model pre-training relies on ViT-FS, a random-initialized ViT trained for only 40 epochs on 40k synthetic images. That is very likely undertrained for ViT-L, so the 16.93 pp gap over ViT-FS conflates pre-training with under-fitting. The authors acknowledge that large-scale ViTs might struggle with limited data, but they still draw the conclusion. A longer training budget for ViT-FS or a stronger from-scratch baseline is needed. The FE versus MADation comparison, by contrast, is not affected by this concern and still supports the value of LoRA adaptation.\n\nThere are no error bars, which is common in this subfield but worth noting. Otherwise the benchmark setup is fair and the code release helps reproducibility.\n\nWho this is for: anyone working on MAD or face biometrics method transfer. It's a niche but security-relevant task, and the paper gives a strong baseline. It deserves a serious referee; the Table 2 correction and baseline strengthening should be required before acceptance, not desk rejection.\n\nRecommendation: engage with it, with the caveats above.","headline":"CLIP+LoRA works for morphing detection and the paper is worth engaging with, but a Table 2 mislabel and an undertrained baseline need fixing.","tokens_in":19947,"tokens_out":2692,"would_cite":true,"duration_ms":22509,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adapting a pre-trained CLIP model with low-rank LoRA weights and a trained classifier yields a face morphing attack detector that outperforms from-scratch ViTs and is competitive with specialised MAD systems.","keywords":["face morphing attack detection","foundation models","CLIP","LoRA","low-rank adaptation","vision transformer","synthetic training data","biometrics"],"falsifier":"Run the same LoRA-plus-classifier training on SMDD from randomly initialized CLIP weights (no pre-training) for the same 40 epochs and compare average EER on MAD22 and MorDIFF: if the random-init model approaches MADation's roughly 11.9% average EER, the advantage over from-scratch ViTs is a product of the LoRA training procedure, not of CLIP's pre-trained knowledge.","tokens_in":18914,"feed_emoji":"🛡️","tokens_out":7717,"duration_ms":67651,"temperature":0.7,"pith_summary":"The paper claims that a face morphing attack detector built by adapting a pre-trained CLIP image encoder with low-rank LoRA weights, while training a small binary classifier on top, outperforms the same transformer architectures trained from scratch as well as a frozen-feature baseline, and is competitive with recent specialised MAD systems. The result matters because morphing attacks let several people verify against the same passport photo, and detectors usually need large labelled training sets; MADation instead trains only a small set of LoRA matrices and a classification layer on a synthetic dataset. The evidence is a set of controlled comparisons: zero-shot CLIP performs poorly, frozen-feature CLIP helps, and LoRA-adapted CLIP gives the best average EER across the MAD22, MorDIFF, and FRLL-Morphs benchmarks.","feed_headline":"CLIP + LoRA beats from-scratch ViTs at face-morph detection","feed_subtitle":"Small trainable LoRA matrices adapt frozen CLIP weights, cutting average EER by 16.93 points on ViT-L.","key_machinery":"The central mechanism is Low-Rank Adaptation (LoRA) applied to a frozen CLIP image encoder, with a rank-stabilized scaling factor: for each adapted attention layer the update is $W = W_0 + \\gamma_r BA$ with $B \\in \\mathbb{R}^{d\\times r}$, $A \\in \\mathbb{R}^{r\\times k}$, and $\\gamma_r = \\alpha/\\sqrt{r}$ (rsLoRA), applied only to the query and value projection matrices. Alongside these trainable matrices, a two-neuron fully connected header with softmax is trained with binary cross-entropy, producing the bona-fide-versus-morph decision. Because the pre-trained weights stay frozen and only the low-rank matrices and header are updated, the method adapts the embedding space to the MAD task while preserving CLIP's pre-trained knowledge.","core_discovery":"On its own terms, the paper's discovery is that a foundation model's pre-trained feature space can be aligned to the face-morphing-attack detection task by rank-stabilized low-rank adaptation, producing a detector that outperforms transformer baselines and prior MAD methods in several scenarios. Concretely, for a CLIP ViT-L backbone, MADation reduces the average detection equal error rate by 16.93 percentage points relative to training the same ViT from scratch and by 8.10 points relative to using the frozen CLIP encoder with only a classifier; the ViT-B variant shows the same ordering with gains of 10.24 and 9.56 points, respectively. The paper positions MADation as the first application of foundation models to MAD, and reports near-perfect detection on some morphing techniques, such as zero EER for FaceMorph with ViT-B, while remaining competitive on harder GAN-based and diffusion-based morphs.","pith_inferences":["Editorial inference: if the from-scratch ViT baseline were trained until convergence rather than for a fixed 40 epochs, part of the gap might shrink; the paper's cleanest claim is that LoRA adaptation of a frozen FM is an efficient way to reach competitive MAD performance, not that pre-training is strictly necessary.","Editorial inference: the same LoRA-plus-header recipe could plausibly transfer to other low-data biometric sub-tasks, such as presentation attack detection or deepfake detection, where a domain-specific shift must be learned from small datasets.","Editorial inference: the zero-shot results show CLIP's text-image prompting is weak for morph detection except on some GAN attacks with ViT-L, suggesting that a text-guided prompt-tuning variant, rather than only LoRA on the image encoder, is a natural next experiment."],"forward_implications":["MADation is best or second-best in 23/42 (ViT-B) and 21/42 (ViT-L) of the MAD22/MorDIFF scenarios against prior solutions, and 12/20 and 9/20 on FRLL-Morphs.","Adapting the FM with LoRA improves over both the frozen-feature extractor and the from-scratch ViT, indicating that pre-trained knowledge and task-specific fine-tuning combine productively for MAD.","The detector generalizes across unseen morphing techniques, including GAN-based MIPGAN, diffusion-based MorDIFF, and landmark-based methods, despite training only on OpenCV-morphed synthetic images.","Because only LoRA matrices and a classification header are trained, the approach adds minimal trainable parameters and no inference overhead, making it a computationally inexpensive MAD solution.","The publicly released implementation allows other groups to reproduce and extend the method."],"supporting_citations":[{"why":"Provides the pre-trained CLIP image encoder that MADation adapts with LoRA.","marker":"[45]"},{"why":"Introduces the LoRA low-rank adaptation mechanism used to update only small matrices.","marker":"[25]"},{"why":"Supplies the rank-stabilized scaling factor alpha/sqrt(r) (rsLoRA) used in MADation's LoRA layers.","marker":"[32]"},{"why":"Demonstrates LoRA fine-tuning of CLIP for face recognition, guiding the choice of CLIP and training hyper-parameters.","marker":"[11]"},{"why":"Provides the SMDD synthetic morph dataset on which all compared methods are trained.","marker":"[14]"},{"why":"Defines the MAD22 benchmark and SYN-MAD 2022 evaluation protocol used for the main comparisons.","marker":"[27]"},{"why":"Introduces the MorDIFF diffusion-morph benchmark used in evaluation.","marker":"[13]"},{"why":"Supplies the FRLL-Morphs benchmark used for additional comparisons with prior MAD methods.","marker":"[48]"}],"fun_headline_variants":["CLIP+LoRA detects face morphs: EER down 16.93 pts vs ViT-L from scratch","MADation: First foundation-model face morph detector, using CLIP+LoRA","Face morph attack detection: CLIP with LoRA beats from-scratch ViTs","Zero EER on FaceMorph: MADation's CLIP+LoRA tackles morph attacks","CLIP+LoRA for face-morph MAD: 16.93-point EER gain over ViT-L from scratch"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the from-scratch ViT baseline was trained well enough to represent what a non-foundation-model transformer can do, since it got only 40 epochs on a small synthetic dataset.","fun_headline_variants_meta":{"raw":{"variants":["CLIP+LoRA detects face morphs: EER down 16.93 pts vs ViT-L from scratch","MADation: First foundation-model face morph detector, using CLIP+LoRA","Face morph attack detection: CLIP with LoRA beats from-scratch ViTs","Zero EER on FaceMorph: MADation's CLIP+LoRA tackles morph attacks","CLIP+LoRA for face-morph MAD: 16.93-point EER gain over ViT-L from scratch"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000878,"raw_usage":{"total_tokens":3819,"prompt_tokens":987,"completion_tokens":2832,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":2704}},"tokens_in":603,"tokens_out":2832,"duration_ms":17117,"temperature":1.0,"reasoning_tokens":2704,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:46:15.558872+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same LoRA-plus-classifier training on SMDD from randomly initialized CLIP weights (no pre-training) for the same 40 epochs and compare average EER on MAD22 and MorDIFF: if the random-init model approaches MADation's roughly 11.9% average EER, the advantage over from-scratch ViTs is a product of the LoRA training procedure, not of CLIP's pre-trained knowledge.","supporting_citations":[{"cited_title":"Learning transferable visual models from natural language supervi- sion","cited_arxiv_id":null,"evidence_quote":"Provides the pre-trained CLIP image encoder that MADation adapts with LoRA."},{"cited_title":"Privacy-friendly synthetic data for the development of face morphing attack detectors","cited_arxiv_id":null,"evidence_quote":"Provides the SMDD synthetic morph dataset on which all compared methods are trained."},{"cited_title":"Syn-mad 2022: Competition on face morphing attack detec- tion based on privacy-aware synthetic training data","cited_arxiv_id":null,"evidence_quote":"Defines the MAD22 benchmark and SYN-MAD 2022 evaluation protocol used for the main comparisons."},{"cited_title":"Mordiff: Recognition vul- nerability and attack detectability of face morphing attacks created by diffusion autoencoders","cited_arxiv_id":null,"evidence_quote":"Introduces the MorDIFF diffusion-morph benchmark used in evaluation."}],"review_version":1}